Computer search warrants are common during criminal investigations. Computer forensic software retrieves data for use in prosecution while counter-forensic software and encryption is used to obliterate and secure information. Darren Chaker of Las Vegas posts this material to help people understand the focus of search warrants.
INCLUSIVE EDUCATION PRACTICES FOR TEACHERS AND TRAINERS.pptx
Darren Chaker Computer Search Warrant
1. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
DIGITIZING THE FOURTH AMENDMENT: LIMITING THE
PRIVATE SEARCH EXCEPTION IN COMPUTER
INVESTIGATIONS
Benjamin Holley*
O UR lives increasingly rely on computers: for work, for play,
for learning, and for socializing. Accordingly, more and more
personal information is stored on those computers. Yet these ma-
chines on which we depend are vulnerable: hardware and software
can fail, virtual intruders can compromise our privacy, and thieves
can walk away with our digital lifeline to the world. While all of
these situations are frustrating, none seem to raise novel criminal
procedure questions. What if, however, a third party turns over
someone’s data to the police? For example, if a repair technician
finds an image of child pornography on a computer, must the po-
lice, absent a warrant, limit themselves to viewing just that file, the
folder it was in, or may they search the entire computer? What if
the third party gained access to the files not by agreement with the
computer owner but by “hacking”? And to what extent should the
police be held responsible for the actions of these third parties? In
our increasingly online world, these questions—raising issues of
privacy, crime control, and constitutional law—will only become
more common. Yet courts considering police re-creations of pri-
vate computer searches have thus far developed widely varying ap-
proaches with dramatically different implications.
Each question above relates to the “private search exception” of
the Fourth Amendment. It is well-established that government
agents may, without a warrant, re-create a search that was origi-
nally conducted by a private individual, so long as they do not ex-
*
Assistant State's Attorney, McLean County, Illinois. J.D., 2009, University of Vir-
ginia School of Law; B.A., 2006, Truman State University. The views expressed in this
Note are the author’s alone and do not necessarily reflect the views of the Office of
the McLean County State’s Attorney. Thanks to the staff of the Virginia Law Review
for their hard work and helpful comments and to Reneé Gordon Holley for her pa-
tience and proofreading acumen.
677
2. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
678 Virginia Law Review [Vol. 96:677
ceed the scope of that original search.1 Judicial opinions applying
the private search exception to computer cases have, however, de-
veloped conflicting approaches as to both agency (that is, who
qualifies as a government agent) and scope (that is, what precisely
the government may view), and no clear standards predominate.
Commentators have noted this inconsistency,2 and some have of-
fered short analyses,3 but none have published an in-depth exami-
nation of the varying approaches to, and possible solutions for, this
conflict. This Note attempts to fill that gap by examining various
judicial efforts to apply the private search exception to modern
technology, discussing the merits of each, and proposing solutions
that maintain the spirit of the exception without sacrificing gov-
ernmental interests or diminishing privacy rights. Specifically, it ar-
gues that because of the unique nature of computer technology,
courts should broadly construe the agency prong and narrowly in-
terpret the scope prong of the private search exception in com-
puter search situations.
Part I provides necessary background information relating to
both the private search exception and the structure of modern
computers. Part II notes the difficulties courts have encountered in
applying the first prong of the private search exception—agency—
to computer cases. Part III follows by examining the difficulties in-
herent in the second prong of the exception—scope—and how the
1
See, e.g., Paul G. Reiter, Annotation, Admissibility, In Criminal Case, of Evidence
Obtained by Search by Private Individual, 36 A.L.R.3d 553, 557–58 (1971); see also
infra Section I.A.
2
Susan S. Kreston, Computer Search and Seizure Issues in Internet Crimes Against
Children Cases, 30 Rutgers Computer & Tech. L.J. 327, 355–61 (2004); Tara McGraw
Swaminatha, The Fourth Amendment Unplugged: Electronic Evidence Issues &
Wireless Defenses, 7 Yale J.L. & Tech. 51, 69–70 (2004).
3
Thomas K. Clancy, The Fourth Amendment Aspects of Computer Searches and
Seizures: A Perspective and a Primer, 75 Miss. L.J. 193, 236–44 (2005); Orin S. Kerr,
Searches and Seizures in a Digital World, 119 Harv. L. Rev. 531, 547–48 (2005) (advo-
cating an “exposure-based approach”); James M. Rosenbaum, In Defense of the
Sugar Bowl, 9 Green Bag 2d 55, 55–56 (2005) (examining the scope problem in terms
of the particularity requirement for warrants). Even those commentators who pro-
pose solutions to the conflict focus primarily on the Fourth Amendment requirement
that warrants “particularly describ[e] the place to be searched, and the persons or
things to be seized.” Id. at 55 (quoting U.S. Const. amend. IV). Though the debate
regarding warrant specificity is relevant, this Note focuses on non-warrant private
search exception situations, which turn on the scope of the private search versus the
government agent search. These issues are slightly, but importantly, different.
3. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
2010] Digitizing the Fourth Amendment 679
subtle differences between courts’ varying approaches actually
have dramatic implications. Part IV argues that courts should in-
terpret the agency prong broadly and the scope prong narrowly.
Finally, Part V anticipates possible objections to this conclusion
and offers some replies.
I. BACKGROUND
A. Private Search Exception
Though ratified in 1791, the Bill of Rights has withstood the
march of time remarkably well, even as courts have struggled to
adapt the amendments’ protections to an ever-changing society
unimaginable to the Founders. This struggle continues as courts at-
tempt to harmonize the Fourth Amendment’s protection of “[t]he
right of the people to be secure in their persons, houses, papers,
and effects, against unreasonable searches and seizures”4 with
modern investigations and prosecutions of crime. As technology
has evolved, the Supreme Court has added several nuances to the
warrant requirement by creating new exceptions5 and expanding
the scope of others.6 All the while, the Court has sought to balance
citizens’ rights with the government’s need to enforce the laws.7
One warrant exception, applicable in both the “real” and virtual
worlds, is the private search exception.
The private search exception contains two prongs: (1) the initial
search must not be made by an agent of the government, and (2)
the subsequent government search must not be “significantly more
intrusive or extensive than the earlier private search.”8 If either
4
U.S. Const. amend. IV.
5
See, e.g., Carroll v. United States, 267 U.S. 132 (1925) (discussing the automobile
exception).
6
See, e.g., Richard S. Julie, Note, High-Tech Surveillance Tools and the Fourth
Amendment: Reasonable Expectations of Privacy in the Technological Age, 37 Am.
Crim. L. Rev. 127, 131–32 (2000) (discussing the effect of advanced technology on
Fourth Amendment doctrine).
7
See, e.g., Kyllo v. United States, 533 U.S. 27 (2001) (considering the use of a ther-
mal imaging device); United States v. Knotts, 460 U.S. 276 (1983) (considering the use
of an electronic tracking device).
8
1 Wayne R. LaFave, Search And Seizure: A Treatise On The Fourth Amendment
§ 1.8(b) (4th ed. 2004) (citing Walter v. United States, 447 U.S. 649 (1980)); see also
United States v. Jacobsen, 466 U.S. 109, 116 (1984) (affirming the Walter plurality in-
4. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
680 Virginia Law Review [Vol. 96:677
prong is not satisfied, the government may not use the discovered
evidence in trial.
The first prong—agency—arises out of the fact that the Fourth
Amendment only constrains government action.9 Therefore, “it is
wholly inapplicable to a search or seizure, even an unreasonable
one, effected by a private individual not acting as an agent of the
Government or with the participation or knowledge of any gov-
ernmental official.”10 Accordingly, the government may use infor-
mation obtained by private individuals, even if the individual vio-
lated the law to obtain it.11
The Supreme Court has not clearly indicated the circumstances
under which the government is considered responsible for private
conduct, offering only the vague guideline that the result “neces-
sarily turns on the degree of the Government’s participation in the
private party’s activities, . . . a question that can only be resolved
‘in light of all the circumstances.’”12 Lower courts have adopted two
approaches.13 The first applies a three-factor test, asking (1)
“whether the government knew of and acquiesced in the intrusive
conduct”; (2) “whether the private party’s purpose in conducting
the search was to assist law enforcement”; and (3) “whether the
government requested the action or offered the private actor a re-
ward.”14 The alternative approach simply drops the third factor.15
sofar as “the legality of the governmental search must be tested by the scope of the
antecedent private search”).
9
See Reiter, supra note 1, at 561–62 (listing numerous state and federal cases agree-
ing with this proposition).
10
Jacobsen, 466 U.S. at 113 (quoting Walter, 447 U.S. at 662 (Blackmun, J., dissent-
ing)) (internal quotation marks omitted). But see United States v. Allen, 106 F.3d
695, 698–99 (6th Cir. 1997) (suggesting in dicta that Jacobsen does not permit law en-
forcement to reenact a private search of a private home or residence).
11
For an argument against this rule in computer-based cases, see Monica R. Shah,
Note, The Case for a Statutory Suppression Remedy to Regulate Illegal Private Party
Searches in Cyberspace, 105 Colum. L. Rev. 250 (2005).
12
Skinner v. Ry. Labor Executives’ Ass’n, 489 U.S. 602, 614–15 (1989) (quoting
Coolidge v. New Hampshire, 403 U.S. 443, 487 (1971)); see also United States v.
Crowley, 285 F.3d 553, 558 (7th Cir. 2002); Swaminatha, supra note 2, at 61.
13
See Computer Crime & Intellectual Prop. Section, Criminal Division, U.S. Dep’t
of Justice, Searching and Seizing Computers and Obtaining Electronic Evidence in
Criminal Investigations 12–13 (3rd ed. 2009), http:// www.justice.gov/ crimi-
nal/cybercrime/ ssmanual/ssmanual2009.pdf [hereinafter DOJ Manual 2009], and
cases cited therein.
14
Crowley, 285 F.3d at 558 (internal citations omitted).
15
See, e.g., United States v. Miller, 688 F.2d 652, 657 (9th Cir. 1982).
5. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
2010] Digitizing the Fourth Amendment 681
The second prong—scope—rests on the theory that once a pri-
vate individual searches another’s possessions, the owner’s expec-
tation of privacy has been destroyed. Therefore, “the Fourth
Amendment does not prohibit governmental use of the now non-
private information.”16 However, “if the authorities use informa-
tion with respect to which the expectation of privacy has not al-
ready been frustrated,” the traditional Fourth Amendment
protections apply.17
To avoid venturing into entirely uncharted territory, courts have
sought analogies from “real world” law to apply to digital search
cases. The most common involve a term found throughout Fourth
Amendment precedent: “containers.”18 This term is well-defined
for physical world law,19 but as will be seen,20 has no agreed-upon
definition in the digital world. In traditional analysis, a container is
simply “any object capable of holding another object,”21 and the
Supreme Court has so far refused to treat different types of con-
tainers differently.22 Importantly, every opening of a container con-
stitutes a separate search,23 so the government must produce a justi-
16
United States v. Jacobsen, 466 U.S. 109, 117 (1984); see also Crowley, 285 F.3d at
558 (“The Fourth Amendment is not triggered when a private party initiates a search
and contacts police after evidence is discovered.”).
17
Jacobsen, 466 U.S. at 117.
18
Indeed, this analogy is almost universally adopted for computer cases by both
courts and commentators. Noah Stacy, Note, Apparent Third Party Authority and
Computers: Ignorance of the Lock Is No Excuse, 76 U. Cin. L. Rev. 1431, 1442 (2008);
see also Kerr, supra note 3, at 550 (“Cases applying the Fourth Amendment to con-
tainers also provide a natural starting point for identifying what it means to ‘search’ a
computer.”). But see Clancy, supra note 3, at 202–03 (noting that some courts and
commentators have rejected the container analogy). Those who reject the container
analogy do not offer alternative analogies, however, instead treating computers as sui
generis in Fourth Amendment analysis.
19
Kerr, supra note 3, at 550.
20
See infra Part III.
21
New York v. Belton, 453 U.S. 454, 460 n.4 (1981).
22
United States v. Ross, 456 U.S. 798, 822 (1982) (“[A] constitutional distinction be-
tween ‘worthy’ and ‘unworthy’ containers would be improper. . . . [A] traveler who
carries a toothbrush and a few articles of clothing in a paper bag or knotted scarf
claim[s] an equal right to conceal his possessions from official inspection as the so-
phisticated executive with the locked attaché case.”).
23
Kerr, supra note 3, at 554 (citing United States v. Block, 590 F.2d 535, 541 (4th
Cir. 1978)) (“Under existing law, the opening of any closed containers inside the
house constitutes a separate search.”).
6. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
682 Virginia Law Review [Vol. 96:677
fication for each one.24 The complex nature of computer storage
makes application of this analogy in the digital setting problematic.
To determine the best approach, it is first necessary to understand
the basics of computer storage.25
B. Computer Architecture
Modern computers are able to store vast amounts of informa-
tion, equal to approximately eighty million pages of text,26 with ca-
pacity doubling approximately every two years.27 For context, this
is more information than is contained in one floor’s worth of aca-
demic journals in the average university library.28
To users, computer files appear to be stored within folders. Each
folder may contain very few (or no) files or may contain thousands
of files. Unlike a physical folder, virtual folders are functionally
unlimited in size.29 Moreover, they are stored hierarchically, con-
taining both files and folders within them. Thus, to extend the con-
tainer analogy, computer folder systems are like matryoshka
24
Id. at 537. This is generally not an issue, as officers may open any container that
could hold the evidence for which they are authorized to search. See also Rosenbaum,
supra note 3, at 55.
25
See G. Robert McLain, Jr., Casenote, United States v. Hill: A New Rule, but No
Clarity for the Rules Governing Computer Searches and Seizures, 14 Geo. Mason L.
Rev. 1071, 1091 (2007) (“[T]he ‘technical’ aspects of computer storage are as relevant
in formulating sound Fourth Amendment rules as the practical considerations that
gave rise to the traditional rules governing container searches. Knowing how evidence
is ‘contained’ on computers, and what kind of searches can discover evidence is essen-
tial to understanding whether the technical distinctions between computers and other
containers should result in legal distinctions in Fourth Amendment search and seizure
rules.”).
26
See Kerr, supra note 3, at 542 (calculating computer storage capacity in 2005 at
forty million pages of text).
27
This phenomenon, known as “Moore’s Law,” has held true since 1965 and is ex-
pected to continue for at least another decade. Intel Corporation, Excerpts from A
Conversation with Gordon Moore: Moore’s Law 1 (2005), http://download.intel.com/
museum/Moores_Law/Video-Transcripts/Excepts_A_Conversation_with_Gordon_
Moore.pdf.
28
See Megabytes, Gigabytes, Terabytes . . . What are They?, http://www.whatsabyte.
com (last visited Nov. 11, 2009) (analogizing digital storage to physical storage capac-
ity); see also Orin S. Kerr, Digital Evidence and the New Criminal Procedure, 105
Colum. L. Rev. 279, 302 (2005) (same).
29
The only limit comes from the amount of storage space remaining on the medium
on which the folders are themselves contained.
7. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
2010] Digitizing the Fourth Amendment 683
dolls—to open one closed container, one must often open another
first.
While this is how the system appears to most users, data are not
actually stored based on a hierarchy of folders. Indeed, forensic
computer searches typically search and display the data in a differ-
ent manner. Law enforcement officers conducting systematic
searches of seized computers usually “image” the hard drive by
creating bitstream copies. A bitstream image does not merely rep-
licate each file and folder, but copies every bit of information in
exactly the same order as it is on the original machine.30 This
“physical level” differs from the “virtual level” generally seen by
users.31 As one commentator explains:
A bitstream copy is different from the kind of copy users nor-
mally make when copying individual files from one computer to
another. A normal copy duplicates only the identified file, but
the bitstream copy duplicates every bit and byte on the target
drive including all files, the slack space, Master File Table, and
metadata in exactly the order they appear on the original.
Whereas casual users make copies of files when their machines
are running, analysts generally create bitstream copies using spe-
cial software after the computer has been powered down. The
bitstream copy can then be saved as a “read only” file so that
32
analysis of the copy will not alter it.
Accordingly, officers conducting analysis at the physical level
may be unable to determine exactly how the files and folder appear
on a “virtual” level.33 This distinction is critical to developing the
appropriate analogue to real-world searches and thereby appropri-
ately applying the Fourth Amendment.
30
Orin S. Kerr, Computer Crime Law 320 (2006).
31
Id. at 332; see also McLain, supra note 25, at 1092–96 (explaining the difference
between manual and forensic searches).
32
Kerr, supra note 3, at 541 (internal citations omitted).
33
Id. at 544; see generally, Orin S. Kerr, The Problem of Perspective in Internet
Law, 91 Geo. L.J. 357 (2003). But see People v. Emerson, 766 N.Y.S.2d 482, 492 (Sup.
Ct. 2003) (claiming that it is impossible to “access any individual image file without
going through the folder directory or table of contents page”).
8. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
684 Virginia Law Review [Vol. 96:677
II. DETERMINING AGENTS OF THE GOVERNMENT: AGENCY
PROBLEMS IN THE CYBERCRIME CONTEXT
The unique nature of computer storage, both in terms of size and
format, creates problems that the traditional doctrine of agency is
ill-equipped to handle. This Part describes the facts of several cases
that highlight these problems and the approaches developed by
various courts. These real-world cases also serve as a basis for the
analysis developed in Part IV.
One of the most common factual situations giving rise to private
search analysis in computer cases involves repair technicians who
observe evidence of illegal activity—usually child pornography—
while attempting to fix a client’s computer.34 United States v. Barth
provides a good example of the repair problem, as well as a factual
twist raising further agency issues.35
Michael Barth, a self-employed accountant, voluntarily turned
over his computer to a repairman, Ken Kellar, because it was run-
ning slowly.36 Kellar, while attempting to diagnose and solve the
problem, opened a .jpg file37 that contained an image of what ap-
peared to be child pornography.38 He immediately shut down the
computer and contacted law enforcement. Interestingly, Kellar was
an FBI confidential informant,39 and, while waiting for a return call
34
See, e.g., United States v. Grimes, 244 F.3d 375 (5th Cir. 2001); United States v.
Barth, 26 F. Supp. 2d 929 (W.D. Tex. 1998); Emerson, 766 N.Y.S.2d at 482; see also
DOJ 2009 Manual, supra note 13, at 11 (noting that repair technicians finding child
pornography is a “common scenario”).
35
26 F. Supp. 2d 929 (W.D. Tex 1998).
36
See id. at 932–35 for the facts in this case, which will not be cited separately here.
37
“.jpg” is a file extension commonly associated with photographic images. Kerr,
supra note 3, at 544 n.57.
38
The opinion does not provide any information as to the file name of the image,
implying that Kellar opened it as a normal part of his diagnosis.
39
Because of FBI policy at the time, this fact was unknown to the other law en-
forcement officers (including FBI agents) and the Assistant United States Attorney
(“AUSA”), who advised and directed the subsequent investigation. Believing that
this hampered the ability of the investigators and the AUSA to make informed legal
judgments about the case, the judge refused to apply the “good faith” exception to the
otherwise impermissible search and attached a postscript to the opinion “urg[ing] the
FBI to review its policy on confidential informants like Kellar . . . .” Barth, 26 F. Supp.
2d at 942–43. See also Stephan K. Bayens, The Search and Seizure of Computers: Are
We Sacrificing Personal Privacy for the Advancement of Technology?, 48 Drake L.
Rev. 239, 256 (2000) (“[I]t is no surprise that private computer technicians are rapidly
becoming confidential informants for various law enforcement agencies. Due to the
9. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
2010] Digitizing the Fourth Amendment 685
from his FBI contact, he alerted the Odessa Police Department
(“OPD”), to whom he had also previously provided information.40
OPD Officer Roy Vic asked Kellar to bring in the hard drive the
following day, and FBI Special Agent Jane Kelly instructed him to
copy all of the files onto removable disks so that an agent could
pick them up the next morning. Kellar indicated that he would take
the computer to the OPD offices to make copies, and Agent Kelly
concurred with his decision. After his conversations with the FBI
and OPD officers, Kellar restarted the computer, opened addi-
tional files, and discovered more seemingly illicit images. He took
the computer to OPD the next day and, after Kellar and OPD offi-
cers reviewed some of the files on it, allowed OPD to make a copy
of the hard drive. Eventually a search warrant was obtained, based
solely on the information provided by Kellar. In the subsequent
prosecution, Barth challenged the evidence as the fruit of imper-
missible warrantless searches, arguing, inter alia, that Kellar was a
government agent and that law enforcement had impermissibly ex-
panded the scope of Kellar’s search.41
Addressing the agency issue, the court held that although Kel-
lar’s status as a confidential informant was potentially problematic,
it did not necessarily make him a government agent because there
was “no evidence that Kellar intended to assist law enforcement
officers when he initially viewed the image.”42 But the court found
the subsequent private search “[m]ore troublesome” because Kel-
lar “was not opening private files in an effort to repair the machine;
he did so for the purpose of assisting law enforcement officials.”43
This, the court held, made Kellar an agent of the government, even
though no law enforcement official directed or even expected him
to conduct that search.44 Because Kellar had discussed the case with
an FBI agent, the court held that the government was on notice of
growing number of these ‘dual purpose’ technicians and the public’s absolute reliance
on these technicians for computer assistance, the analysis for when a private individ-
ual is converted into a government actor may need to be modified to protect privacy
interests.”).
40
The Court does not indicate the nature of Kellar’s prior assistance to either the
FBI or OPD.
41
Barth, 26 F. Supp. 2d at 935.
42
Id. at 936.
43
Id.
44
Id.
10. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
686 Virginia Law Review [Vol. 96:677
the likelihood of a private search, which “triggered the acquies-
cence.”45
Agency issues also arise when individuals “hack” into another’s
computer and then turn over files discovered on that computer to
law enforcement. As discussed above, the private search exception
has no exclusionary rule or statutory suppression remedy, even for
otherwise illegal activity.46 Normally, then, evidence obtained from
an illegally-accessed computer is admissible against a defendant,47
assuming, of course, that the intruder was working independently
of the government.
In United States v. Jarrett,48 an individual using the name “Un-
knownuser” employed a “Trojan horse”49 to gain unauthorized ac-
cess to the defendant’s computer, a tactic he had used previously
against another individual who was subsequently convicted of sex-
ual exploitation of minors.50 While browsing the defendant’s files,
he found several images of child pornography, which he then for-
warded to law enforcement officials.51 In the course of several e-
mail exchanges between law enforcement and Unknownuser about
the cases, FBI Agent Margaret Faulkner wrote Unknownuser in
what the court described as “the proverbial ‘wink and a nod’”:
45
Id.
46
See supra note 11 and accompanying text.
47
This raises the disturbing possibility of significant abuse. If one is able to access
another’s computer and retrieve files, she could likely plant files on the victim com-
puter as well. Thus, one could “hack” into a computer, add images of child pornogra-
phy, and then send some of those files to law enforcement to cause an arrest of the
unwitting victim. Depending on the skill of the intruder, such a scheme would be very
difficult, if not impossible, to detect. See, e.g., Jordan Robertson, AP IMPACT:
Framed for Child Porn—By a PC Virus, ABC News, Nov. 8, 2009,
http://abcnews.go.com/Technology/wireStory?id=9028516.
48
338 F.3d 339 (4th Cir. 2003).
49
A “Trojan horse” is a program willingly installed by a user but that contains a
hidden malicious element. See, e.g., United States v. Kline, 112 F. App’x 562, 564 n.1
(9th Cir. 2004) (“[The private searcher] attached his ‘Trojan Horse’ virus to pictures
of child pornography on the internet. When an individual downloads a picture, as [the
defendant] did, the virus is also downloaded onto that individual’s computer. The vi-
rus then allows [the private searcher] to open, alter, and download files on the in-
fected computer.”).
50
See Jarrett, 338 F.3d at 341 (citing United States v. Steiger, 318 F.3d 1039, 1044
(11th Cir. 2003)). The court assumed, as does this Note, that Unknownuser is male,
and thus referred to “he” and “his.”
51
Id. at 342.
11. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
2010] Digitizing the Fourth Amendment 687
I can not ask you to search out cases such as the ones you have
sent to us. That would make you an agent of the Federal Gov-
ernment . . . . But if you should happen across such pictures . . .
please feel free to send them to us . . . . We also have no desire to
52
charge you with hacking.
The court, though acknowledging that “the Government oper-
ated close to the line in this case,” held that the evidence against
Jarrett was admissible because the “wink and a nod” e-mails were
almost all sent after the search of Jarrett’s computer had already
53
occurred. Unknownuser’s previous contacts were not enough to
establish an “ongoing relationship” with law enforcement, and evi-
dence from his subsequent searches was therefore admissible. The
court indicated, though, that further evidence developed by Un-
knownuser would be inadmissible.54
Though complicated slightly by technology, most agency ques-
tions arising from repair technician and virtual-intruder situations
are amenable to this type of traditional private search exception
analysis.55 But cybercrime can present more difficult complications
in other contexts. For example, several states have enacted laws
mandating the reporting of illegal material found during a private
search.56 Some specifically require computer repair technicians to
report any potentially illegal material they find while examining a
computer, with stiff penalties for non-reporting.57
52
Id. at 343.
53
Id. at 347.
54
Id. at 346–47 (noting that “more explicit representations and assurances (as in the
post-hoc Faulkner emails)” would be needed to show an agency relationship).
55
The Jarrett court, for example, applied the test established by Skinner v. Railway
Labor Executives’ Ass’n, 489 U.S. 602, 614 (1989) (regarding drug tests of railway em-
ployees), and its progeny. 338 F.3d at 344.
56
See Child Welfare Information Gateway, Mandatory Reporters of Child Abuse
and Neglect: State Statutes Series 3 (2008), www.childwelfare.gov/ systemwide/
laws_policies/ statutes/manda.pdf (“In approximately 18 States and Puerto Rico, any
person who suspects child abuse or neglect is required to report. Of these 18 States, 16
States and Puerto Rico specify certain professionals who must report but also require
all persons to report suspected abuse or neglect, regardless of profession.”).
57
See National Conference of State Legislatures, Child Pornography Reporting Re-
quirements (ISPs and IT Workers) (2008), http://www.ncsl.org/default.aspx?tabid
=13460 (noting at least seven states that mandate reporting of child pornography by
computer technicians, the majority of which provide criminal penalties for failure to
report).
12. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
688 Virginia Law Review [Vol. 96:677
United States v. Peterson addressed just such a statute.58 Harry
Peterson took his computer to a local repair center because of boot
errors.59 Harry Griffin, the technician on duty, attempted to fix the
problem. Once he was able to power up the computer, he noticed
“several adult links to web sites” with titles such as “Lolitas Live.”
Griffin continued to diagnose the boot error and, while doing so,
explored the “My Documents” folder, finding files with male
names. He opened one of the files and discovered what appeared
to be child pornography. “[R]emember[ing] news stories that re-
ported computer stores were required by law to report ‘evidence of
child pornography to the Police[,]’ [h]e . . . decided to ‘investigate’
a little deeper” and “opened several files under the ‘My Docu-
60
ments’ section that revealed” apparent child pornography. He al-
so found pornographic video clips but could not determine if the
participants were underage.61 Griffin copied some of the files to
62
provide to the police because he was “unsure of what to do next.”
The South Carolina law Griffin remembered provides that “any
computer technician working with a computer who views an image
of a child . . . engaging in sexual conduct . . . must report the name
and address of the . . . owner or person in possession of the com-
puter to law enforcement officials.”63 Unlike similar laws in other
states,64 it does not apply criminal sanctions to a failure to report
but does insulate “anyone making the report” from civil liability.65
The court held that Griffin was not an agent of the government
for Fourth Amendment purposes, writing that “[i]t cannot be said
that the language of this statute shows that the government knew
of and acquiesced in Griffin’s search.”66 Based on this determina-
tion, it did not consider whether Griffin’s search was intended to
assist law enforcement.67
58
294 F. Supp. 2d 797 (D.S.C. 2003), aff’d, 145 F. App’x 820 (4th Cir. 2005).
59
See Peterson, 294 F. Supp. at 799–800 for the facts of this case, which will not be
cited separately here.
60
Id. at 800.
61
Id. (“I could not see faces in either clip, so I have no sure idea how old the partici-
pants were.”).
62
Id.
63
S.C. Code Ann. § 16-3-850 (2003).
64
National Conference of State Legislatures, supra note 57.
65
S.C. Code Ann. § 16-3-850.
66
Peterson, 294 F. Supp. 2d at 805.
67
Id.
13. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
2010] Digitizing the Fourth Amendment 689
A further agency wrinkle develops for non-law enforcement
government agents.68 Computer administrators employed by the
government—for example, a state university network administra-
tor or employees of a government agency’s IT department—
generally have near-total access to the files of users on their net-
works and take steps, including searching those private files, to
protect the security of the network.69 Are the fruits of those
searches then admissible against a defendant?
The case of United States v. Heckenkamp provides some prelimi-
nary answers.70 Jeffrey Savoy, a computer network investigator for
the University of Wisconsin-Madison—a public school—was
alerted by FBI Special Agent Terry Rankhorn to possible unau-
thorized access of the school’s system.71 Savoy investigated the
problems and discovered that an unauthorized individual had
gained root-level access, creating the potential for substantial dis-
ruption to the system. In an attempt to protect the university net-
work, Savoy searched the defendant’s computer remotely.72 He
then re-contacted Agent Rankhorn, who advised Savoy to wait to
take further action, as Rankhorn was attempting to obtain a search
warrant.73 Instead, Savoy, accompanied by university police offi-
cers, physically entered the defendant’s unoccupied dorm room
through an open door and unplugged the defendant’s computer.74
Officers later obtained consent to search the computer.
68
Though the Supreme Court’s decision in New Jersey v. T.L.O., 469 U.S. 325, 333
(1985), established that, in general, public employees other than law enforcement are
covered by the Fourth Amendment, the exclusionary rule might not apply to their
unauthorized searches. 1 LaFave, supra note 8, § 1.8 (“[T]he T.L.O. case made it
abundantly clear that the question of whether the Fourth Amendment is applicable to
certain non-police governmental activity and the question of whether the Fourth
Amendment’s exclusionary rule is applicable to that conduct are not one and the same
and might not inevitably be answered in the same way.”).
69
For a discussion of whether computers connected to a university network are truly
private, see infra Section IV.B.
70
482 F.3d 1142 (9th Cir. 2007).
71
Id. at 1143. Agent Rankhorn was alerted to a problem by a computer system ad-
ministrator for Qualcomm Corporation, who had discovered unauthorized access of
his company’s network. Agent Rankhorn then traced the information back to the uni-
versity. Id.
72
Id. at 1145.
73
Id.
74
Id.
14. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
690 Virginia Law Review [Vol. 96:677
The Ninth Circuit examined the case through the lens of Heck-
enkamp’s reasonable expectation of privacy and only briefly con-
sidered whether Savoy was an agent of the government for Fourth
Amendment purposes:
Although Savoy was aware that the FBI was also investigating
[potential computer crimes], his actions were not taken for law
enforcement purposes. Not only is there no evidence that Savoy
was acting at the behest of law enforcement, but also the record
indicates that Savoy was acting contrary to law enforcement re-
quests that he delay action.
Under these circumstances, a search warrant was not neces-
sary because Savoy was acting purely within the scope of his role
75
as a system administrator.
According to this analysis, Savoy was not an agent of the gov-
ernment, despite his status as a government employee and the fact
that university police officers accompanied him to the defendant’s
room.76
Each of the situations presented above highlights the tension in-
herent in applying the traditional agency rules to a digital world.
Solutions to these problems are examined below in Part IV, but
this Note first examines further problems that arise in the second
prong of the private search exception: scope.
III. THREE APPROACHES TO SCOPE PROBLEMS IN REENACTED
PRIVATE COMPUTER SEARCHES
Thus far, very few courts have addressed the issues that arise
when law enforcement reenacts or expands a private computer
75
Id. at 1147.
76
See also 1 LaFave, supra note 8, § 1.8 (“[W]hen the public official is not a police
officer, is not otherwise a part of the criminal justice system in the broad sense of that
phrase, and does not have responsibilities which involve (except perhaps upon the
rarest of occasions) investigation of activities which might later be a proper subject of
criminal prosecution or similar proceedings, then it just may be that the prospect of
exclusion bringing about any deterrence in like future situations is so remote that the
[good faith exception] would properly be applied.”).
15. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
2010] Digitizing the Fourth Amendment 691
search.77 Three approaches have emerged from the case law, each
employing a different level of generality to determine the appro-
priate extent of a reenacted search.78
A. Limiting the Scope to Files
The first and most specific approach is exemplified by United
States v. Barth,79 the facts of which are discussed above in the con-
text of agency.80 To recall, law enforcement officers copied and
searched Barth’s entire hard drive, though the repair technician
who had originally discovered the illicit images had only opened a
few files.
The court held, independent of its conclusion that the repair
technician was an agent of the government when he viewed all but
one of the files, that officers had impermissibly expanded the scope
of the private search.81 First, it found that Barth retained a reason-
able expectation of privacy in the contents of his computer, an ex-
pectation that was destroyed only as to the one file the repair tech-
nician, Kellar, had viewed as a private actor. Because officers
viewed many more images prior to obtaining a warrant, their
search “far exceeded Kellar’s viewings.”82 Additionally, the taint of
this impermissible search extended to the subsequent warrant-
based searches, rendering them invalid as well.83
Thus, Barth stands for the proposition that government reen-
actment of a private computer search must be limited to the indi-
vidual files already searched. It held that the rest of the computer,
77
See Donald Resseguie, Note, Computer Searches and Seizure, 48 Clev. St. L. Rev.
185, 198 (2000) (noting that “there are but a few reported cases involving private
party searches of computers”).
78
The three cases presented here serve merely as exemplars of the varying ap-
proaches courts have adopted. They are not the only cases to have considered the is-
sue but provide the best starting point for analysis of the positions.
79
26 F. Supp. 2d 929 (W.D. Tex. 1998).
80
See supra notes 36–46 and accompanying text.
81
Barth, 26 F. Supp. 2d at 937.
82
Id. The court never indicated how many specific files were searched or how many
images of child pornography were found.
83
Id. at 938–39. Barth also consented to the search of his home and office but, be-
cause he had been informed of the existence of the warrant, the court held that the
consent was involuntary. Id. at 940.
16. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
692 Virginia Law Review [Vol. 96:677
even files in the same folder as that already searched, was beyond
the scope of the private search.84
B. Limiting the Scope to Folders
A second approach, taken in People v. Emerson, focuses on digi-
tal folders rather than files.85 The facts of Emerson mirror many of
the other private search cases. Specifically, Emerson was unable to
boot his computer and so voluntarily provided the hard drive to a
technician for repair.86 The technician, Patrick Mulrooney, exam-
ined the computer on December 7. After locating several viruses,
Mulrooney was able to reboot the drive. Once the computer
started, he immediately found several files with pornographic ti-
tles.87 As he continued to work on the computer, Mulrooney
opened a folder, labeled “xxx,” and found “pages of file names de-
88
scribing children performing sexual acts.” Mulrooney found simi-
lar files in a separate folder, labeled “MPG.”89 He opened some of
these files and found that they too contained child pornography.
Based on these discoveries, Mulrooney contacted the local po-
lice department, which sent an officer the following Monday, De-
cember 10. Mulrooney opened several of the files containing the
child pornography to show the officer, who then took the com-
puter, for which he obtained a search warrant the following day.
Emerson argued that Mulrooney, when conducting his private
search on December 7, accessed eighteen files in the “xxx” folder
84
The Tenth Circuit reached a similar conclusion for warrant-based searches in
United States v. Carey, 172 F.3d 1268, 1273 (10th Cir. 1999). In Carey, officers had a
warrant to search the defendant’s computer for evidence of drug trafficking. Upon
discovering evidence of child pornography, the investigating officer abandoned the
search for drug evidence and spent five hours looking for additional child pornogra-
phy. The court held that the images were “closed files” and thus the officer was “ex-
panding the scope of his search” when he opened additional files. Id. Though the
Carey court focused on the “plain view” exception to the warrant requirement, its
reasoning closely resembles that of Barth.
85
766 N.Y.S.2d 482 (Sup. Ct. 2003). On reargument, the court declined to alter its
original decision. Id. at 495.
86
The facts of this case appear in 766 N.Y.S.2d at 484–85 and will not be cited sepa-
rately here.
87
The court does not say that these file names indicated child pornography, how-
ever. Id. at 484.
88
Id.
89
The court does not indicate the relevance or meaning, if any, of this label. Id.
17. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
2010] Digitizing the Fourth Amendment 693
and six in the “MPG” folder, whereas six “xxx” files and thirty-one
“MPG” files were accessed in front of the officer. Thus, Emerson
claimed, the government search impermissibly exceeded the pri-
vate search and the evidence obtained from the expanded search
should be suppressed.90
Unlike the Barth court, the Emerson court focused on the com-
puter folders, holding that the folders were “‘closed containers’ as
that term has been interpreted under the Fourth Amendment.”91
The court also attached “critical importance” to the fact that the
searched files and folders actually contained child pornography, as
their titles had apparently suggested.92 The court summarized its
holding as follows:
[W]hen an earlier, private search opens child pornography image
files on a hard drive in identified computer file folders which the
private searcher found replete with file titles plainly suggesting
images of like kind, defendant retains no reasonable expectation
of privacy with respect to additional such image files in the same
93
two computer file folders.
90
On reargument, the defendant claimed that the limits of the technical evidence
should require the court to assume that the files and folders were searched for the
first time on December 10. The court rejected this assumption as “without merit” as
the original decision “did not turn upon this particular detail.” Id. at 492.
91
Id. at 487. The court did leave open the possibility of a Barth-type analysis, writing
that “perhaps even the individual image files themselves” constituted closed contain-
ers, but did not apply this framework, opting instead to focus on folder contents and
file names. Id.; cf. Resseguie, supra note 77, at 203 (“When a small computerized ad-
dress book or pager is compared to a closed container, this makes a great deal of
sense since these devices will generally have the ability to store a limited amount of
information all of which is similar. When applied to a larger computer storage device,
such as a PC hard drive that has the ability to store a vast amount of information of
various types, the closed container analogy is limited.”).
92
Emerson, 766 N.Y.S.2d at 487. Despite the importance of these file names to the
court’s analysis, the opinion does not provide the name of any file. On reargument,
the court attempted to distinguish situations involving “simple obscenity” from child
pornography. “If we were only dealing with materials alleged to be obscene . . . [the
Court would need to make an] additional finding beyond sexual explicitness, which
could only occur by a viewing of the files. . . . In the context of child pornography,
however, a labeling which clearly says that an image file contains a sexual perform-
ance by a child . . . needs no additional viewing to determine that it is, indeed, contra-
band.” The court is not clear as to what labels clearly and inevitably reveal their con-
tents in such a way. Id. at 493–94.
93
Id. at 488.
18. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
694 Virginia Law Review [Vol. 96:677
Despite some ambiguity, the Emerson decision seems to con-
strain law enforcement to searches conducted within the same
folders, but not the same files, as the private search.94 The court did
not, however, decide if files or folders are the correct level of
analysis when file names are not “plainly suggesti[ve]” of illicit
contents.95
C. “Limiting” the Scope to Disks
A third approach appears in United States v. Runyan.96 In Run-
yan, the defendant’s estranged wife, Judith, broke into his home
and retrieved several computer disks.97 One of Judith’s friends then
viewed some of the contents of some of the disks. Upon finding
images of child pornography, she contacted the local sheriff’s de-
partment and turned over several of the disks. Over the following
weeks, Judith provided additional disks to various law enforcement
agencies. During the ensuing investigation, Customs Service Spe-
cial Agent Rick Nuckles asked to participate in the case. He was
provided with all the relevant physical evidence, including all of the
disks provided by Judith and her friend. He then “performed an
analysis on every piece of evidence he had received, copying the
98
materials onto blank CDs.” He examined several of the images
from each disk, including disks that neither Judith nor her friend
had accessed. Based in part on this information, Agent Nuckles
filed for two search warrants, one to search all the disks for illicit
images and another to search Runyan’s home for any computer
devices. One of the affidavits indicated that another officer had
94
On reargument, the court likened folders to a “table of contents” and asserted
that it is impossible to access a file without accessing the folder first. Id. at 494. But
see supra note 33 and accompanying text.
95
Emerson, 766 N.Y.S.2d at 488; see also United States v. Knoll, 16 F.3d 1313, 1320
(2d Cir. 1994) (“If the files were closed and their contents not apparent from the exte-
rior, the reasonable expectation of privacy continued so long as the files had not been
searched before contact with the government occurred.”).
96
275 F.3d 449 (5th Cir. 2001).
97
The court referred to compact discs, 3.5-inch floppy disks, and ZIP disks collec-
tively as “disks.” The facts in this case appear in 275 F.3d at 452–56 and will not be
cited separately here.
98
Id. at 454.
19. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
2010] Digitizing the Fourth Amendment 695
conducted a “cursory” review of the disks. Based on this informa-
tion, a magistrate judge issued both warrants.99
Like the courts in Barth and Emerson, the appellate court ap-
plied the closed-container analogy to digital storage.100 Unlike those
courts, however, it regarded the disks, rather than files or folders,
as the relevant container.101 Thus, the court framed the question
presented as “whether the police exceeded the scope of the private
search when they examined the entire collection of ‘containers’
(i.e., the disks) turned over by the private searchers, rather than
confining their search to the selected containers examined by the
private searchers.”102 The court concluded that
the police exceed the scope of a prior private search when they
examine a closed container that was not opened by the private
searchers unless the police are already substantially certain of
what is inside that container based on the statements of the pri-
vate searchers, their replication of the private search, and their
103
expertise.
Applying that rule to the facts before it, the court held that gov-
ernment searches of the disks the wife had searched were accept-
able, while searches of disks she had not accessed were not.104
D. Are the Three Approaches Actually Different?
In many respects, these approaches employ quite similar analyti-
cal methodologies. For example, each court in the cases discussed
above employed the “closed-container” analogy105 and examined
99
The search of Runyan’s home revealed one additional image of child pornogra-
phy, on a backup tape.
100
Runyan, 275 F.3d at 461.
101
Id. at 458 (“Because neither party contests this point, we assume without deciding
that computer disks are ‘containers.’”). The court later emphasized that it was “as-
suming without deciding that the parties are correct in their characterization of com-
puter storage devices as ‘closed containers.’” Id. at 462 n.13. Despite these caveats,
the court nowhere indicated that it preferred, or even considered, an alternative anal-
ogy.
102
Id. at 462.
103
Id. at 463.
104
Id. at 464.
105
Id. at 461; United States v. Barth, 26 F. Supp. 2d 929, 936 (W.D. Tex. 1998); Peo-
ple v. Emerson, 766 N.Y.S.2d 482, 487 (Sup. Ct. 2003) (citing Runyan, 275 F.3d at
464–65).
20. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
696 Virginia Law Review [Vol. 96:677
the defendant’s expectation of privacy in the items examined. In-
deed, the Emerson court’s opinion favorably quoted a lengthy sec-
tion of Runyan, though it expressly limited the approval of that
analysis to the Emerson facts.106 It also left open the slight possibil-
ity that files, rather than folders, may be the proper level of analy-
sis.107 Additionally, the courts in both Barth and Runyan ruled in
favor of the defendant (at least partially), and the Emerson court
seemed willing to do so had the files been named less suggestively.
Two important distinctions, however, divide the approaches.
First, and most significantly, each differs as to the application of
the closed-container analogy to the digital world: Runyan applies it
to disks,108 Emerson to folders,109 and Barth to files.110 As will be
seen below, this seemingly small difference has substantial implica-
tions. Second, the Emerson and Runyan courts permit law en-
forcement expansion of a private search if officers are “substan-
tially certain” that the unsearched files contain illicit material;111
Barth does not provide such an expansion. Section IV.B examines
these distinctions and argues that limiting the scope of the private
search to files provides the best framework.
106
Emerson, 766 N.Y.S.2d at 489 & n.4 (“This court agrees with the [Runyan] ra-
tionale insofar as it applies to the particular facts [here] . . . . Because of the location
and labeling of the computer image files in the ‘MPG’ folder in defendant’s hard
drive, it is unnecessary to apply the full reach of Runyan’s holding . . . to the facts of
this case.”).
107
Id. at 487 (“[W]e start with the proposition that the computer folders containing
the images of child pornography, and perhaps even the individual image files them-
selves, are ‘closed containers’ . . . .”).
108
275 F.3d at 458.
109
766 N.Y.S.2d at 487.
110
26 F. Supp. 2d at 937 (“These files should therefore be afforded the full protec-
tion of the warrant requirement. . . . The Court also finds that Defendant did not lose
his reasonable expectation of privacy in his closed, individual files . . . .”).
111
The Runyan court set forth several factors for making this determination, includ-
ing “statements of the private searchers, their replication of the private search, and
their expertise . . . .” 275 F.3d at 463. The Emerson court agreed with this analysis to a
limited extent. 766 N.Y.S.2d at 489 n.4.
21. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
2010] Digitizing the Fourth Amendment 697
IV. SELECTING THE BEST APPROACH
A. Broadening the Agency Definition for Cybercrime Cases
As discussed above, courts dealing with the problems of Fourth
Amendment agency in the context of cybercrime have taken a va-
riety of approaches.112 To get the right answers, though, courts must
first ask the right questions. The court in United States v. Barth, for
example, properly analyzed the influence of the informant’s prior
service to law enforcement and the effect of silent acquiescence to
further searches.113 Likewise, the court in United States v. Jarrett
provided an extensive discussion of the email exchange between
law enforcement and Unknownuser and then correctly noted that,
because these communications occurred after the search, they did
not create an agency relationship.114 The court in United States v.
Heckenkamp, however, brushed over the fact that Savoy, the com-
puter administrator, was employed by the State, noting only that
he “and the other network administrators generally do not have
the same type of ‘adversarial relationship’ with the university’s
network users as law enforcement officers generally have with
criminal suspects.”115 Such cursory dismissal of an important point
obscures the limits of the exception and hinders the ability of fu-
ture courts to offer more refined analysis.116
Instead of merely commenting in passing that Savoy should be
treated as a private citizen, the Heckenkamp court should have fol-
lowed the lead of the courts in Barth and Jarrett by engaging the
difficult issues, especially those that form the foundation of later
analysis. Specifically, the court should have looked beyond Savoy’s
actions in that particular case to his role more generally. His job
was to administer and protect the university’s computer network.
He no doubt knew that unauthorized access of that network was
112
See supra Part II.
113
26 F. Supp. 2d at 935–36.
114
338 F.3d 339, 347 (4th Cir. 2003).
115
482 F.3d 1142, 1148 (9th Cir. 2007).
116
The court in United States v. Butler, 151 F. Supp. 2d 82, 85 n.2 (D. Me. 2001), rec-
ognized the potential agency issues inherent in a search by university officials of a
student’s computer records but declined to consider them because it ruled that the
defendant had no standing to challenge the search. “I therefore do not address other
interesting issues, [such as:] . . . Were the actions of University employees themselves
a search because as employees of a state institution they are state actors?”
22. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
698 Virginia Law Review [Vol. 96:677
illegal and that his investigations, though at least initially designed
to protect the network, could produce evidence against a defen-
dant, especially as he was originally alerted to the matter by an FBI
Special Agent.117 Further, he apparently had the university police—
clearly government actors—at his disposal, as multiple officers ac-
companied him to his physical search of the defendant’s room.118
Acting against the wishes of a government agent does not, by it-
self, make one a private citizen. For example, if a police captain
tells one of her officers to delay a search until a warrant is ob-
tained, but the officer searches anyway, a court would almost cer-
tainly hold that the search was done by the government and is
therefore not subject to the private search exception. In this case,
Savoy was a public official with investigatory duties, who knew that
his investigations could lead to prosecutions, and who had law en-
forcement officers at his disposal when he sought to conduct a
physical search. In light of these factors, the reasoning—and
probably the result—in Heckenkamp should have proceeded much
differently. Heckenkamp’s analysis is entirely premised on the as-
sumption that Savoy is properly treated as a private citizen. With-
out that assumption, the remaining discussion of his purpose and
intent is largely irrelevant. The court not only skipped over this
foundational element, it reached the wrong result in doing so.
Expanding the number of individuals treated as private citizens
greatly expands the reach of the private search exception. As the
class of private actors is expanded, the realm of private information
becomes more limited. To protect the purpose of the exception,
the presumption should be that any public employee, when per-
forming her government duties, is a government actor. The gov-
ernment would then need to demonstrate why the individual
should not be so treated in a particular case. This approach pro-
vides at least some disincentive for publicly employed computer
administrators, who have near total access to users’ putatively pri-
vate files, to snoop around, as anything they find might not be us-
able in a criminal trial. It does not commit the opposite error, how-
ever, as the government may still argue that, in any given case, the
public official is not properly considered a government actor and
117
Heckenkamp, 482 F.3d at 1143.
118
Id. at 1145.
23. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
2010] Digitizing the Fourth Amendment 699
that the suppression remedy would pose no deterrent effect. The
case-by-case nature of traditional agency analysis is thereby pre-
served.
United States v. Peterson further reflects the dangers of excessive
expansion of the private search exception in computer cases.119
Holding that mandatory reporting statutes do not create an agency
relationship—and that actions taken pursuant to them are there-
fore outside the scope of the Fourth Amendment’s protections—is
problematic for several reasons.
First, such reporting statutes, especially those states that attach
criminal penalties to non-reporting, mandate private action—the
essence of government coercion.120 Though no statute imposes an
affirmative obligation to conduct additional searches upon discov-
ery of illegal material, this fine distinction is likely to be lost on av-
erage citizens seeking to avoid criminal sanctions. Unlike most
mandated reporters, including social workers, police officers, and
hospital employees,121 computer technicians are unlikely to have re-
ceived any training regarding the identification of child abuse or
their legal duties.122 When the government, either directly or indi-
rectly, orders a citizen to search another’s private files, coercion
has occurred, and the private search exception should no longer
apply.
Second, the result in Peterson and similar cases encourages fish-
ing expeditions by private individuals and diminishes individual
privacy. Individuals seeking to comply with the law may search
through more files than necessary, just to be sure that they do not
violate the statute. Individuals without legal training cannot be ex-
pected to carefully parse statutes to determine the exact extent of
their obligations. Indeed, in Peterson, the technician was only
vaguely aware of the statute in question and admitted that he con-
ducted additional searches specifically because he believed he had
119
294 F. Supp. 2d 797 (D.S.C. 2003).
120
See generally Child Welfare Information Gateway, supra note 56.
121
See id. at 2.
122
Cf. United States v. Barth, 26 F. Supp. 2d 929, 936 (W.D. Tex. 1998) (“To draw
the line at any later time would give Kellar, untrained in law enforcement and unre-
strained by the responsibilities and duties of officers sworn to protect the Constitu-
tion, a free reign to violate the protections of the Fourth Amendment while nonethe-
less working for the Government.”).
24. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
700 Virginia Law Review [Vol. 96:677
a legal obligation to do so.123 Such a situation could easily become
common. For example, a repair technician might be aware that he
is to report any child pornography found on a computer; believing
that he might have an obligation to open files with sexually sugges-
tive file names, and not wanting to risk criminal penalties if he is
wrong, a technician may view very private, yet not illegal, informa-
tion. This search, done precisely because of government threats,
should also fall outside the private search exception.
Reporting statutes essentially attempt to draft private individu-
als into government service without providing them the training to
identify illegal material or to handle evidence. Instead, most of the
statutes impose criminal sanctions (including fines and jail time124),
encouraging additional, unnecessary, and intrusive private search-
ing without the protection of the exclusionary rule.
In considering statutory coercion cases, courts should adopt the
two-prong agency test, asking (1) “whether the government knew
of and acquiesced in the intrusive conduct” and (2) “whether the
private party’s purpose in conducting the search was to assist law
enforcement.”125 The party’s intent, for the second prong, will, of
course, depend on the facts of each case. By passing mandatory re-
porting statutes specifically aimed at computer technicians, the
government has demonstrated that it is aware of the possibility of
searches taken precisely because of the statute, arguably satisfying
the first prong.126 If the facts demonstrate that the private searcher
did indeed undertake additional searching because of the per-
ceived statutory duty, the searcher should be considered a govern-
ment agent for Fourth Amendment purposes.
Including the third prong adopted by some courts (“whether the
government requested the action or offered the private actor a re-
123
Peterson, 294 F. Supp. 2d at 800.
124
See, e.g., Okla. Stat. Ann. tit. 21, § 1021.4(b) (2009) (“Any person who violates
the provisions of this section, upon conviction, shall be guilty of a misdemeanor and
shall be punished by the imposition of a fine not to exceed Five Hundred Dollars
($500.00) or by imprisonment in the county jail not to exceed one (1) year, or both
such fine and imprisonment.”).
125
See supra note 15 and accompanying text.
126
Cf. Barth, 26 F. Supp. 2d at 936 (holding that the government’s awareness of the
possibility of a search, even if the government did not approve of that search, was suf-
ficient to find an agency relationship).
25. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
2010] Digitizing the Fourth Amendment 701
ward”127) would not defeat the argument that a mandated reporter
should be considered a government agent. By passing such statutes,
the government certainly seems to encourage, if not explicitly re-
quest, searches. It is a small logical leap from mandating reporting
of the results of a search to requesting the search in the first place.
Moreover, by providing civil immunity for reporting and attaching
criminal penalties to non-reporting, the statutes offer a kind of re-
ward—report the results of a search and avoid punishment, or fail
to report and risk punishment. Such incentives encourage the kinds
of government-sanctioned snooping that the Fourth Amendment is
designed to prevent.
Using either the two- or three-prong analysis, courts should hold
that mandatory reporting statutes—at least as applied to computer
technicians and other private individuals untrained in identification
and preservation of evidence—constitute government coercion
such that searches pursuant to them do not fit within the private
search exception. An agency standard that expands the class of
persons fitting the role of government agent protects individual
privacy without significant harm to law enforcement investigations.
The Barth court recognized the importance of maintaining a nar-
row exception to the Fourth Amendment’s generally stringent re-
quirements. It could have easily justified the second round of
searches by the repair technician on the ground that law enforce-
ment neither directed him to make the search nor knew that he
would. The court correctly held, however, that the government’s
knowledge of the possibility of a subsequent search and lack of an
explicit warning to the contrary made the government complicit in
his searches.128 This narrow formulation puts the onus on law en-
forcement to rein in private individuals when possible and elimi-
nates the “proverbial wink and a nod” searches that diminish indi-
vidual privacy with no risk to the state.
B. Narrowing the Scope of Private Searches
To best protect the purposes of the private search exception, the
agency prong should be interpreted expansively; for the same rea-
son, the scope prong should be interpreted narrowly. As discussed
127
See, e.g., United States v. Crowley, 285 F.3d 553, 558 (7th Cir. 2002).
128
Barth, 26 F. Supp. 2d at 936.
26. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
702 Virginia Law Review [Vol. 96:677
above, courts have adopted three levels of analysis for scope prob-
lems in computer cases: disks (Runyan), folders (Emerson), and
files (Barth). Of these, the Barth framework is best.
1. A Disk-Based Approach is Excessively Broad and Premised on
Faulty Analogies
Beginning at the highest level of generality, a disk-based, Run-
yan-style analysis premises its reasoning on a faulty analogy. Spe-
cifically, the court claimed that officers would be “disinclined to
examine even containers that had already been opened and exam-
ined by private parties for fear of coming across important evi-
dence that the private searchers did not happen to see and that
would then be subject to suppression.”129 Though possibly relevant
in the physical world, this rationale is entirely unpersuasive in the
virtual realm. The Runyan court’s analogy incorrectly assumed that
opening one file may allow officers to inadvertently see the con-
tents of other files. This is simply not the case. Though file names
may be visible, the actual contents of individual files are not visible
unless opened. No court has recognized a privacy interest in the
file names, focusing instead on the contents.130
The Runyan court’s application of the “closed-container” anal-
ogy presents further problems.131 The court did not seem to under-
stand, or at least did not discuss, the capacity difference132 between
portable storage disks and hard drives.133 It held that government
examination of the entire contents of a computer disk accessed by
129
United States v. Runyan, 275 F.3d 449, 465 (5th Cir. 2001).
130
Indeed, the contents of a file constitute the evidence. File names, locations, etc.
are not in themselves illegal (unless somehow obscene). As the contents of the files
are the only evidentiary items of interest, the analysis should focus on that level. See,
e.g., Frasier v. State, 794 N.E.2d 449, 465–66 (Ind. Ct. App. 2003) (rejecting argument
that “the police must rely upon the label given to a file to determine its contents”).
131
See Clancy, supra note 3, at 240 (“The basis for the [Runyan] court’s analysis is
far from clear: why is not the entire hard drive of a computer the container and, once
that container is opened by a private party, all data would be within that search’s
scope; on the other hand, why is not each data file a container, given that each must
be separately ‘opened’ to view the file’s contents?”).
132
The storage capacity of the disks in Runyan varied, but all offered substantially
less storage than the average hard drive. See supra note 97.
133
The Runyan court noted that the rationale of Barth applies to “the contents of
data files” but did not elaborate as to why it adopted a different analysis. 275 F.3d at
458.
27. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
2010] Digitizing the Fourth Amendment 703
a private individual is merely “examin[ing] these materials more
thoroughly than did the private parties.”134 This standard is particu-
larly troublesome in the digital context. Under the Runyan ap-
proach, a private searcher could open a single file on another’s
computer and thereby provide the government legitimate war-
rantless access to the entire hard drive of data.135 Likewise, a net-
worked computer can contain files from a multitude of individuals;
permitting government agents to view all of these files merely be-
cause a private searcher opened one is unreasonable.136 The differ-
ence in scope undermines the spirit and intent of the private search
exception.137 Such an act is not merely examining the computer
“more thoroughly,” but is instead fishing in entirely uncharted wa-
ters.138
134
Id. at 464.
135
In a confusing opinion in United States v. Crist, 627 F. Supp. 2d 575, 586 (M.D. Pa.
2008), Chief Judge Kane accepted the Runyan court’s reasoning but contended that a
search of the hard drive of a computer exceeded the private search because “[a] hard
drive is not analogous to an individual disk. Rather, a hard drive is comprised of many
platters, or magnetic data storage units, mounted together. Each platter, as opposed
to the hard drive in its entirety, is analogous to a single disk as discussed in Runyan.”
It is not clear how this standard should operate, given that several platters of a hard
drive can contain portions of a single file and that determining what data resides on
which platter is difficult, time-consuming, and otherwise of no relevance. Further-
more, while users can and do place certain files on certain individual disks (for exam-
ple, family pictures on one CD, business documents on a separate flash drive), they
have neither the ability nor the need to place files on particular hard drive platters.
136
Kerr, supra note 3, at 556 (“A single physical storage device can store the private
files of thousands of different users. It would be quite odd if looking at one file on a
server meant that the entire server had been searched, and that the police could then
analyze everything on the server, perhaps belonging to thousands of different people,
without any restriction. Furthermore, a single file on a network may actually be stored
in several physical boxes. Some computer storage devices may not be stored in any
boxes at all. Over time, it should become increasingly clear that the Fourth Amend-
ment should track the information, not the physical box.”).
137
This would be analogous to allowing officers who have authority for limited pur-
poses to be in a house to search, quickly and comprehensively, every container in the
house, even if it was not related to their reason for being in the house. See id. (reject-
ing Runyan as leading to “unpredictable, unstable, and even disturbing results”).
138
See also Clancy, supra note 3, at 240 (“If a private party opens ‘tax records 2004,’
under Runyan it would seem that the tax records for other years may be opened by
government agents and not be labeled a search. This approach is undoubtedly incor-
rect. Nothing in previous Supreme Court caselaw supports viewing the entire filing
cabinet as a container that permits wholesale searches of all the files therein once a
private party opens one of them.”).
28. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
704 Virginia Law Review [Vol. 96:677
Finally, the Runyan court asserted that the opening of closed
containers does not impermissibly expand a private search if the
officers “knew with substantial certainty . . . what they would find
inside” because such a search “provides the police with no addi-
tional knowledge that they did not already obtain . . . and frustrates
no expectation of privacy that has not already been frustrated.”139
The court characterized this rule in terms of obviousness:
The guideline that emerges from the above analysis is that . . .
[a] defendant’s expectation of privacy with respect to a container
unopened by the private searchers is preserved unless the defen-
dant’s expectation of privacy in the contents of the container has
already been frustrated because the contents were rendered ob-
140
vious by the private search.
This context-based analysis results from a fact pattern in which
officers did indeed find what they expected. The contents of a
computer file are, of course, “obvious” after an examination of the
file confirms an initial hunch; a court will be strongly inclined to
use post hoc justifications in such cases. Courts should not assume
that expectations will always be confirmed, however, as file names
are not necessarily indicative of contents. File names and exten-
sions can be changed to whatever the user desires and need not
have any connection to the content of the file itself.141 Drawing an
analogy to traditional searches, Judge Kozinski correctly argued
that:
Forcing police to limit their searches to files that the suspect has
labeled in a particular way would be much like saying police may
not seize a plastic bag containing a powdery white substance if it
is labeled “flour” or “talcum powder.” There is no way to know
139
Runyan, 275 F.3d at 463.
140
Id. at 463–64.
141
United States v. Hill, 322 F. Supp. 2d 1081, 1090 (C.D. Cal. 2004) (“‘Computer
records are extremely susceptible to tampering, hiding, or destruction, whether delib-
erate or inadvertent.’ Images can be hidden in all manner of files, even word process-
ing documents and spreadsheets. Criminals will do all they can to conceal contraband,
including the simple expedient of changing the names and extensions of files to dis-
guise their content from the casual observer.” (quoting United States v. Hunter, 13 F.
Supp. 2d 574, 583 (D. Vt. 1998))), aff’d, 459 F.3d 966 (9th Cir. 2006); see also McLain,
supra note 25, at 1095 (“It would seem that the possibility of users changing file ex-
tensions, then, is more likely to fool judges than police officers.”).
29. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
2010] Digitizing the Fourth Amendment 705
what is in a file without examining its contents, just as there is no
142
sure way of separating talcum from cocaine except by testing it.
Thus, while the name of a computer file or folder may allow one to
make assumptions about the contents, it is insufficient to overcome
the warrant requirement.143
Walter v. United States provides further support for this point.144
In Walter, several boxes of projector film “depicting homosexual
activities” were mistakenly delivered to a third party company.145
Each box of film contained “suggestive drawings” and “explicit de-
scriptions of the contents.”146 One employee unsuccessfully at-
tempted to view the film by holding it up to a light source.147 The
FBI eventually seized the film and, without a warrant, viewed the
film via a projector.148 The Court considered whether that viewing
merely recreated the private search or was instead an improper ex-
pansion of the previous search.149
The Court fractured in its holding,150 but in the opinion announc-
ing the judgment of the Court, Justice Stevens wrote that “the pri-
vate party had not actually viewed the films” and, instead, “[p]rior
to the Government screening, one could only draw inferences
142
Hill, 322 F. Supp. 2d at 1090–91. Judge Kozinski continued: “The ease with which
child pornography images can be disguised—whether by renaming sexyteenybop-
persxxx.jpg as sundayschoollesson.doc, or something more sophisticated—forecloses
defendant’s proposed search methodology [limiting officers to keyword and exten-
sion-based searching].” Id.
143
See Clancy, supra note 3, at 243–44 (“[A]lthough the police may have had a high
degree of confidence in what they would find when they opened the container, that
confidence should not eliminate the applicability of the Amendment; instead, that
confidence goes to the reasonableness of the police’s actions.”).
144
447 U.S. 649 (1980).
145
Id. at 651.
146
Id. at 652.
147
Id.
148
Id.
149
Id. at 656.
150
Justice Stevens announced the judgment of the Court in an opinion joined by Jus-
tice Stewart. Justice Marshall concurred in the judgment. Justice White, joined by Jus-
tice Brennan, concurred, but wrote separately because he disagreed with the notion
“that the Government subsequently may conduct the same kind of search that private
parties have conducted without implicating Fourth Amendment interests.” Id. at 661
(White, J., concurring). Finally, Justice Blackmun, joined by the remaining three Jus-
tices, dissented, arguing that “[t]he containers . . . clearly revealed the nature of their
contents.” Id. at 663 (Blackmun, J., dissenting).
30. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
706 Virginia Law Review [Vol. 96:677
about what was on the films.”151 Therefore, “[t]he projection of the
films was a significant expansion of the search that had been con-
ducted previously by a private party,” and the evidence should be
suppressed.152 Importantly, Stevens argued that “[t]he fact that the
labels on the boxes established probable cause to believe the films
were obscene clearly cannot excuse the failure to obtain a warrant;
for if probable cause dispensed with the necessity of a warrant, one
would never be needed.”153 Labeling and context alone, then, are
insufficient to justify a warrantless search. Just as the descriptions
on the boxes did not justify a warrantless search in Walter, file and
folder names do not justify a warrantless digital search.
2. A Folder-Based Approach is Unworkable and Encourages
Gratuitous Searching
The folder-based standard proffered in People v. Emerson pre-
sents a better framework than the disk-based approach given in
Runyan but still suffers from several flaws. Though the chosen
level of generality was not particularly significant to the outcome in
Emerson, the rationale used by the court could allow future
searches excessive latitude.
As discussed above,154 not all computer searches are based on the
hierarchy of folders as they appear to a user. Sophisticated search
techniques examine the “physical level” of the data and may not
replicate the “virtual level” generally seen by users. A folder-based
analysis thus breaks down on both a virtual and physical approach.
On the physical level, the folder structure simply does not appear,
rendering any folder-based framework ineffectual.155 On the virtual
level, the Emerson court relied heavily on the suggestive titles of
the folder names and the fact that the images not privately
searched were named similarly to those that had been. Though
such a situation may provide probable cause, it does not justify a
warrantless search, absent a separate exception. As Justice White
noted in United States v. Jacobsen, “the mere existence of probable
cause to believe that a container or package contains contraband
151
Id. at 657.
152
Id.
153
Id. at 657 n.10.
154
See supra Section I.B.
155
Kerr, supra note 3, at 544.
31. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
2010] Digitizing the Fourth Amendment 707
plainly cannot justify a warrantless examination of its contents.”156
That probable cause can, however, lead to a warrant—thereby
enabling law enforcement to examine additional files.
Moreover, the court did not discuss the proper result in cases in-
volving subfolders with suggestive titles inside of a folder already
privately searched. The reasoning could easily be extended such
that officers could search every folder contained within a parent
folder on the theory that the subfolders are likely to contain similar
files or that the folders are suggestively named.157 Unlike the de-
fendant in Emerson, not all individuals who store child pornogra-
phy create suggestive file and folder names. Consequently, the
government could argue that officers, relying on their experience
and the information from a private searcher, were substantially
certain that innocuously named folders such as “My Pictures” were
likely to contain illicit material. Indeed, officers can do so with near
impunity, for if similar illicit material is found, the court will have a
much easier time justifying, albeit post hoc, the search.158 If nothing
incriminating is found, the defendant has little cause to complain
and little chance of obtaining any remedy.159 Accordingly, there is
almost no deterrent to “fishing expeditions” given an even slightly
incriminating parent folder.
156
466 U.S. 109, 129 (1984) (White, J., concurring in part); see also id. at 114 (“Even
when government agents may lawfully seize such a package . . . the Fourth Amend-
ment requires that they obtain a warrant before examining the contents of such a
package.”); United States v. Ross, 456 U.S. 798, 809–12 (1982).
157
On reargument of People v. Emerson, the court suggested that because the indi-
vidual file names were in “plain view” and suggestive of illegal content, officers could
search them. Presumably this would apply to subfolder names as well. People v. Em-
erson, 766 N.Y.S.2d 482, 494 (Sup. Ct. 2003).
158
See, e.g., Justice Stevens’s dissent in California v. Acevedo, accusing the majority
opinion of such a post hoc justification in a drug seizure case. 500 U.S. 565, 595 n.9,
599 (1991) (Stevens, J., dissenting).
159
There are, of course, remedies other than suppression for violation of Fourth
Amendment rights. These remedies are rarely successful, however, as they require
overcoming several substantial barriers. See Ronald Jay Allen et al., Criminal Proce-
dure: Investigation and Right to Counsel 729 (2005) (“The typical Fourth Amend-
ment case—say, a gratuitous frisk or car search—does not involve the kind of physical
injury or property damage that would translate into significant money damages, even
assuming liability can be established. Particularly if the plaintiffs are unsympathetic
(as many criminal suspects are), juries may be unwilling to impose liability or to
award more than nominal amounts in such cases, making lawsuits seem not worth the
trouble. . . . Another major obstacle is doctrinal: the courts have created a variety of
immunity doctrines that limit government damages liability.”).
32. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
708 Virginia Law Review [Vol. 96:677
The Emerson court lent credence to this fear by seemingly em-
ploying such post hoc rationalizations in its analysis. Though noting
that the discovery of child pornography images was “not, alone, de-
terminative,”160 the court put “critical importance” on the fact that
only child pornography was found.161 It has been long established,
however, that the results of a search cannot serve as its justifica-
tion.162
3. The Benefits of a File-Based Framework
A file-based standard, as the narrowest and most specific of the
possibilities, provides the best framework, both in terms of law and
policy. First, a file-based approach is the most consistent with the
theory of the private search exception. As discussed above,163 the
exception rests on the premise that once one’s private material has
been viewed by another, the expectation that the information will
remain private is no longer valid. Thus, whatever the private
searcher has seen is fair game for law enforcement. Disk- and
folder-based standards both expand the scope of this destroyed ex-
pectation to include information merely located (virtually) “near”
the information already viewed.
This is inconsistent with the theory underlying the exception. To
apply an analogy, exposing the information contained in one com-
puter file does not expose the information in other files any more
than opening one suitcase exposes the contents of what is in an-
other nearby suitcase. As Professor Clancy argues, “a computer
should be viewed as a physical container with a series of electronic
‘containers’—that is, directories, folders, and files that must be
each separately opened. Each separate opening is the examination
of a new container.”164
160
Emerson, 766 N.Y.S.2d at 488.
161
Id. at 487. The court went on to note that officers did not access “other types of
private information elsewhere on the computer’s hard drive,” as though the lack of
further incriminating evidence reduced the intrusiveness of the search. Id. at 488.
162
“[I]f any point is solidly grounded in Fourth Amendment jurisprudence, it is that
the police cannot ‘bootstrap’ themselves into probable cause; a search may not be jus-
tified by what turns up in that search.” 3 LaFave, supra note 8, at § 7.2(d).
163
See supra notes 7–8 and accompanying text.
164
Clancy, supra note 3, at 240; see also Kerr, supra note 3, at 555 (“If you analogize
a computer hard drive to a suitcase, each file is like its own zippered pocket in the
33. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
2010] Digitizing the Fourth Amendment 709
Moreover, incriminating evidence will nearly always derive from
the content of individual files, as opposed to the labels (that is, file
names) of folders or disks. Accordingly, this level is the most logi-
cal place to draw the line of what private information has already
been viewed. Any other approach allows the government to exam-
ine a much greater amount of content (that is, potential evidence)
than the private searcher ever did.
Additionally, a file-based standard still provides law enforce-
ment adequate means to investigate possible crimes discovered by
private searchers. Officers need merely replicate the private search
and determine if the previously viewed files do provide evidence of
a crime. If so, those files are admissible against the defendant. If
not, or if officers would prefer to look for more files,165 they need
merely to obtain a search warrant, a routine practice for law en-
forcement agencies.166
At least one commentator argues that even a file-level analysis is
too broad, because
[i]f the police perform a simple search from within the operating
system, they will only be able to see files, making files the rele-
vant “containers.” If, however, the police use forensic tools, the
“containers” become the sectors and clusters (which may or may
167
not make up a complete file) on the storage media.
This argument, while accurately distinguishing physical and vir-
tual searches, is simply not relevant in private search situations.
Private searches will almost always use the computer at the virtual
suitcase. A computer is like a container that stores thousands of individual containers
in the form of discrete files.”).
165
For example, officers might prefer to examine more files for sentencing purposes,
as the amount of contraband possessed may determine or influence the applicable
sentence.
166
For example, in United States v. Hall, 142 F.3d 988, 991 (7th Cir. 1998), the defen-
dant took his computer to a repair technician who subsequently discovered child por-
nography. The technician alerted law enforcement, who did not view any files them-
selves but instead sought—and received—a search warrant for the computer. The
court therefore did not need to make any determinations regarding the scope of the
private search and, after quickly establishing that the technician was not an agent of
the government, upheld the warrant as valid. Id. at 991–94. But cf. United States v.
Harned, No. 98-10227, 1999 U.S. App. LEXIS 11397, at *13–14 (9th Cir. June 2, 1999)
(“[P]robable cause for a search warrant may not rest entirely upon the bare conclu-
sion of a computer store employee as to the nature of the photographs.”).
167
McLain, supra note 25, at 1096.
34. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
710 Virginia Law Review [Vol. 96:677
level and are extremely unlikely to use forensic tools to search the
computer. In recreating a search, then, officers may not expand the
scope of the search beyond files opened by the private searcher
but, at the same time, should not be overly constrained by the pri-
vate searcher’s lack of forensic tools. In other words, because files
are the smallest unit of navigation encountered on the virtual level
used by private searchers, files should determine the scope of the
government agent’s search.
Professor Kerr presents a more nuanced version of this point,
suggesting that only what is actually “exposed to human observa-
tion” has been searched.168 Thus, metadata, such as access times
and modification history,169 are generally not part of the private
search and may not be viewed by law enforcement absent a war-
rant or other exception. The file-based approach proposed in this
Note would permit searching of the metadata of files previously
viewed by the private searcher, even if that searcher did not ob-
serve the metadata, because once a private searcher views a file,
the defendant’s expectation of privacy in that file is lost. Moreover,
distinguishing between parts of the files is impossible on a physical-
level search (where metadata is included with the rest of the file in-
formation).
Additionally, though it is possible to determine retroactively
what files a private searcher has viewed, officers are not necessarily
able to know what parts of those files the searcher viewed. For ex-
ample, a private searcher may open a multi-page document file,
168
Kerr, supra note 3, at 547–48 (“[I]n the case of a search by a private actor, gov-
ernment agents may view only the information viewed by the private actor unless they
first obtain a warrant.”).
169
See, e.g., Adam Israel, Note, To Scrub or Not to Scrub: The Ethical Implications
of Metadata and Electronic Data Creation, Exchange, and Discovery, 60 Ala. L. Rev.
469, 472–73 (2009) (“Metadata is essentially the history of a document. Every com-
ment, every edit, every iteration of a document is hidden within that document,
chronicling its life. . . . The metadata of a typical Microsoft Word document may in-
clude: the author’s name and initials; the name of the company or organization
where the document was created; the name of the author’s computer; the name of the
server or network on which the document was saved; the names of previous document
authors; the original text, along with any revisions to the original text; template in-
formation; any digital comments made on the document; document versions; and hid-
den text. Metadata is also produced by Corel WordPerfect and other popular word
processing software, Microsoft Excel and PowerPoint, and other similar programs.
Furthermore, e-mails also contain metadata.”).
35. HOLLEY_SECONDNIGHT 4/19/2010 11:39 AM
2010] Digitizing the Fourth Amendment 711
but officers would not necessarily know what parts of the docu-
ment, if any, the searcher viewed, thus presenting numerous practi-
cal difficulties in attempting to re-create the search without
impermissibly expanding its scope. To draw a real-world analogy, a
private searcher who opened a journal may not have read every
single page, though police could, using the private search excep-
tion, closely examine each entry. Accordingly, the file-level ap-
proach, and not an observation-based analysis, best preserves the
purposes of the private search exception without unduly hindering
law enforcement.170
In the end, the exceptions to the warrant requirement must be as
narrow as possible while still retaining their purpose. Excessive ex-
pansion obviates the warrant requirement and leads to unnecessar-
ily intrusive searches that are only justified post hoc. As the Su-
preme Court has noted, “[t]he exceptions to the rule that a search
must rest upon a search warrant have been jealously and carefully
drawn.”171 A file-based standard retains that tight reading of the ex-
ception and should be adopted by courts facing similar issues in the
future.
170
It is perhaps noteworthy that the distinction between Professor Kerr’s and this
Note’s proposed framework is largely moot in most private search cases; both analy-
ses would lead to the same results in all the cases discussed here. As Kerr notes, most
cases “involve possession of digital images of child pornography, in which the contra-
band image is both the file contents and the exposed data. The distinction between
files and data collapses in this context . . . .” Kerr, supra note 3, at 556. Kerr further
concedes that “[t]he exposure-based approach is critical only when the officer has le-
gitimately viewed part of the file but has no authority to conduct a new search
through the rest of it,” a rare situation indeed. Id. at 557. The distinction could be im-
portant, however, in certain cases. Metadata information—such as who viewed a
document and when—may be vital in determining culpability in insider trading and
other white collar crimes, for example.
171
Jones v. United States, 357 U.S. 493, 499 (1958). This rule has been cynically at-
tacked on the grounds that it is not actually employed in practice. See, e.g., Edwin
Butterfoss, As Time Goes By: The Elimination of Contemporaneity and Brevity as
Factors in Search and Seizure Cases, 21 Harv. C.R.-C.L. L. Rev. 603, 649 (1986)
(“The Court no longer adheres to the maxim that a search or seizure is per se unrea-
sonable unless it is supported by a warrant or falls within a jealously and carefully
drawn exception to the warrant requirement. Instead, the Court simply evaluates po-
lice conduct under a general notion of reasonableness.”).